--- title: MikroTrick: Inside the RouterOS Takeover Chain | daily.dev description: Bishop Fox reproduced the MikroTrick RouterOS takeover chain, combining CVE-2026-67279 (an SSH rekey flaw that bypasses authentication state) with... canonical: https://daily.dev/posts/mikrotrick-inside-the-routeros-takeover-chain-zvgsi14sl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: MikroTrick: Inside the RouterOS Takeover Chain | daily.dev og:description: Bishop Fox reproduced the MikroTrick RouterOS takeover chain, combining CVE-2026-67279 (an SSH rekey flaw that bypasses authentication state) with... og:url: https://daily.dev/posts/mikrotrick-inside-the-routeros-takeover-chain-zvgsi14sl og:image: https://api.daily.dev/og/posts/ZvGSi14sl.png og:image:alt: MikroTrick: Inside the RouterOS Takeover Chain og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # MikroTrick: Inside the RouterOS Takeover Chain **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 10 min read · 0 upvotes · 0 comments ## Summary Bishop Fox reproduced the MikroTrick RouterOS takeover chain, combining CVE-2026-67279 (an SSH rekey flaw that bypasses authentication state) with CVE-2026-86060 (a login helper that treats a crafted username as a trusted administrative identity). The chain grants full admin access on vulnerable RouterOS 7.x builds without credentials. During field testing, Bishop Fox found routers with persistence artifacts—scripts and scheduled tasks with numeric owner "0"—consistent with real-world exploitation before patches were public. MikroTik fixed both issues in RouterOS 6.49.21, 7.23.4, and 7.24.2, but patching does not remove existing attacker footholds. The post details the patch diffs, a non-invasive detection technique, and mitigation/investigation steps including credential rotation and configuration review. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-67279 in MikroTik RouterOS and how does it bypass authentication? CVE-2026-67279 lets an unauthenticated SSH client reach post-login functionality by triggering a key rekey before authenticating. On vulnerable RouterOS builds, completing the rekey moves the connection to the next protocol phase without a user having logged in, letting the client open a session channel and submit an execution request despite having no authenticated identity or permissions. _Teams tracking router exposure the moment an advisory drops can follow SSH CVE disclosures like this one on daily.dev._ ### How does CVE-2026-86060 turn a username into an admin login on MikroTik RouterOS? RouterOS's SSH service passes the client-supplied username as a command-line argument to a login helper. That helper has a legacy mode where a username starting with a dash, like -2, is read as a file descriptor number instead of a name, letting an attacker supply a fake trusted identity record over the SSH terminal that grants full administrator permissions without normal authentication. _Developers auditing privilege-escalation bugs like this can follow the writeup thread on daily.dev._ ### Which RouterOS versions fix the MikroTrick vulnerability chain and what do the patches change? RouterOS 6.49.21, 7.23.4, and 7.24.2 fix the chain. The SSH dispatcher now checks that a session has an assigned policy before processing connection-layer requests, and the SSH login path now rejects usernames starting with a dash, space, or containing control characters before invoking the login helper, closing both the rekey bypass and the file-descriptor trick. _Ops teams deciding when to patch exposed routers can track advisories like this on daily.dev._ ## Similar posts on daily.dev - [MikroTrick Exploit: Hackers Are Hijacking MikroTik Routers](https://daily.dev/posts/mikrotrick-exploit-hackers-are-hijacking-mikrotik-routers-80n3a2orx) · Medium · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/mikrotrick-inside-the-routeros-takeover-chain-zvgsi14sl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"MikroTrick: Inside the RouterOS Takeover Chain","url":"https://daily.dev/posts/mikrotrick-inside-the-routeros-takeover-chain-zvgsi14sl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/mikrotrick-inside-the-routeros-takeover-chain-zvgsi14sl"},"datePublished":"2026-09-17T21:22:15.651Z","dateModified":"2026-09-17T23:08:05.970Z","description":"Bishop Fox reproduced the MikroTrick RouterOS takeover chain, combining CVE-2026-67279 (an SSH rekey flaw that bypasses authentication state) with...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd048316927b934a9c4ded63f8cba1cf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd048316927b934a9c4ded63f8cba1cf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/mikrotrick-inside-the-routeros-takeover-chain-zvgsi14sl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vulnerability,ssh","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"MikroTrick: Inside the RouterOS Takeover Chain"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/mikrotrick-inside-the-routeros-takeover-chain-zvgsi14sl#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-67279 in MikroTik RouterOS and how does it bypass authentication?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-67279 lets an unauthenticated SSH client reach post-login functionality by triggering a key rekey before authenticating. On vulnerable RouterOS builds, completing the rekey moves the connection to the next protocol phase without a user having logged in, letting the client open a session channel and submit an execution request despite having no authenticated identity or permissions. Teams tracking router exposure the moment an advisory drops can follow SSH CVE disclosures like this one on daily.dev."}},{"@type":"Question","name":"How does CVE-2026-86060 turn a username into an admin login on MikroTik RouterOS?","acceptedAnswer":{"@type":"Answer","text":"RouterOS's SSH service passes the client-supplied username as a command-line argument to a login helper. That helper has a legacy mode where a username starting with a dash, like -2, is read as a file descriptor number instead of a name, letting an attacker supply a fake trusted identity record over the SSH terminal that grants full administrator permissions without normal authentication. Developers auditing privilege-escalation bugs like this can follow the writeup thread on daily.dev."}},{"@type":"Question","name":"Which RouterOS versions fix the MikroTrick vulnerability chain and what do the patches change?","acceptedAnswer":{"@type":"Answer","text":"RouterOS 6.49.21, 7.23.4, and 7.24.2 fix the chain. The SSH dispatcher now checks that a session has an assigned policy before processing connection-layer requests, and the SSH login path now rejects usernames starting with a dash, space, or containing control characters before invoking the login helper, closing both the rekey bypass and the file-descriptor trick. Ops teams deciding when to patch exposed routers can track advisories like this on daily.dev."}}]} ```